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Chairman Cruz, Ranking Member Sinema, Members of the Subeommittee: 

Thank you for the opportunity to appear before you today to discuss the current state of 
aviation safety. On behalf of the United States Department of Transportation and the Federal 
Aviation Administration, we extend our deepest sympathy to the families of the victims of the 
recent Ethiopian Airlines accident, as well as the Lion Air accident. 

Safety is the core of the Federal Aviation Administration’s mission and our top priority. 
With the support of this Committee, we have worked tirelessly to take a more proactive, data- 
driven approach to oversight that instills a safety above all approach inside the FAA and within 
the aviation community that we regulate. The result of this approach is that the United States has 
the safest air transportation system in the world. Since 1997, the risk of a fatal commercial 
aviation accident in the United States has been cut by 95 percent. And in the past ten years, there 
has only been one commercial airline passenger fatality in the United States in over 90 million 
flights. But a healthy safety culture requires commitment to continuous improvement. 

Our commitment to safety and fact-based, data-driven decision making has been the 
guiding principle in the FAA’s response to the two fatal accidents involving the Boeing 737 
MAX airplane outside the United States. Today, I would like to provide you with an overview 
of the FAA’s certification and oversight processes, our current actions with respect to the 737 
MAX, and the next steps that the FAA will take to foster safety enhancements here and abroad. 



The FAA is a Data-Driven Agency Focused on Safety 

As the aerospace system and its components become increasingly more complex, we 
know that our oversight approach needs to evolve to ensure that the FAA remains the global 
leader in achieving aviation safety. In order to maintain the safest air transportation system in 
the world, during the past two decades the FAA has been evolving from a prescriptive and more 
reactive approach for its safety oversight responsibilities to one that is performance-based, 
proactive, centered on managing risk, and focused on continuous improvement. A key part of 
this transition has been the adoption of safety management systems, or SMS, within the FAA. 
The evolution toward SMS began internally at the FAA more than 15 years ago, starting with the 
FAA’s Air Traffic Organization and expanding across the FAA to include all of our lines of 
business. Consistent with recommendations of the International Civil Aviation Organization 
(ICAO), we have been working with industry towards implementation of SMS in various sectors. 
For example, as of March 9, 2018, scheduled commercial air carriers, regulated under 14 CFR 
part 121, are required to have an SMS. 

Safety is not just a set of programs that can be “established” or “implemented.” It is a 
way of living and working, and it requires the open and transparent exchange of information. 

We know that it takes collaboration, communication, and common safety objectives to allow the 
FAA and the aviation community to come together, to identify system hazards, and to implement 
safety solutions. This approach gives us knowledge that we would not otherwise have about 
events and risks. Sharing safety issues, trends, and lessons learned is critical to recognizing 
whatever might be emerging as a risk in the system. The more data we have, the more we can 
learn about the system, which in turn allows us to better manage and improve the system. 
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To be clear, the SMS approach does not diminish the FAA’s role as a safety regulator. 
Any party that the FAA regulates remains responsible for compliance with the FAA’s regulatory 
standards, and the FAA does not hesitate to take enforcement action when it is warranted. 
Aircraft Certification 

One of the FAA’s core functions, aircraft certification, has always relied on the exchange 
of information and technical data. The FAA certifies the design of aircraft and components that 
are used in civil aviation operations. Some version of our certification process has been in place 
and served us well for over 60 years. This does not mean the process has remained static. To the 
contrary, since 1964, the regulations covering certification processes have been under constant 
review. As a result, the general regulations have been modified over 90 times, and the rules 
applicable to large transport aircraft, like the Boeing 737 MAX, have been amended over 130 
times. The regulations and our policies have evolved in order to adapt to an ever-changing 
industry that uses global partnerships to develop new, more efficient, and safer aviation products 
and technologies. 

The FAA focuses its efforts on areas that present the highest risk within the system. The 
FAA reviews the applicant’s design descriptions and project plans, determines where FAA 
involvement will derive the most safety benefit, and coordinates its intentions with the applicant. 
When a particular decision or event is critical to the safety of the product or to the determination 
of compliance, the FAA is involved either directly or through the use of our designee system. 

The designee program was originally authorized by Congress in 1958 and is critical to the 
success and effectiveness of the certification process. Under this program, the FAA may 
delegate a matter related to aircraft certification to a qualified private person. This is not self- 
certification; the FAA retains strict oversight authority. The program allows the FAA to 
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leverage its resources through delegation. Last fall, Congress specifically directed the FAA to 
make full use of this authority in the FAA Reauthorization Act of 2018. In aircraft certification, 
both individual and organizational designees support the FAA. The FAA determines the level of 
involvement of the designees and the level of FAA participation needed based on many 
variables. These variables include the designee’s understanding of the compliance policy; 
consideration of any novel or unusual certification areas; or instances where adequate standards 
may not be in place. 

The Organization Designation Authorization (ODA) program is the means by which the 
FAA may authorize an organization to act as a representative of the FAA, allowing that 
organization to conduct inspections and tests and issue certificates on behalf of the FAA. 
Currently, there are 79 ODA holders. ODA certification processes allow an applicant greater 
flexibility and control over schedules than applicants whose projects are directly managed by the 
FAA. The FAA has a rigorous process for issuing an ODA. ODA holders must have 
demonstrated experience and expertise in FAA certification processes, a qualified staff, and an 
FAA-approved procedures manual before they are appointed. The procedures manual defines an 
ODA holder’s authority and limitations, and identifies the functions it may perform. 

The FAA determines its level of involvement on a project-by-project basis. There are 
many issues that will always require direct FAA involvement, including equivalent level of 
safety determinations, and rulemakings required to approve special conditions. The FAA may 
choose to be involved in other project areas after considering factors such as our confidence in 
the applicant, the applicant’s experience, the applicant’s internal processes, and confidence in the 
designees. 
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Something that is not well understood about the eertification process is that it is the 
applicant’s responsibility to ensure that an aircraft conforms to FAA safety regulations. It is the 
applicant who is required to develop aircraft design plans and specifications, and perform the 
appropriate inspections and tests necessary to establish that an aircraft design complies with the 
regulations. The FAA is responsible for determining that the applicant has shown that the 
overall design meets the safety standards. We do that by reviewing data and by conducting risk- 
based evaluations of the applicant’s work. 

The FAA is directly involved in the testing and certification of new and novel features 
and technologies. When a new design, or a change to an existing design, of aircraft is being 
proposed, the designer must apply to the FAA for a design approval. While an applicant usually 
works on its design before discussing it with the FAA, we encourage collaborative discussions 
well in advance of presenting a formal application. Once an applicant approaches us, a series of 
meetings are held both to familiarize the FAA with the proposed design, and to familiarize the 
applicant with the certification requirements. A number of formal and informal meetings are 
held on issues ranging from technical to procedural. Once the application is made, issue papers 
are developed to provide a structured way of documenting the resolution of technical, regulatory, 
and administrative issues that are identified during the process. 

Once the certification basis is established for a proposed design, the FAA and the 
applicant develop and agree to a certification plan and initial schedule. In order to receive a type 
certificate, the applicant must conduct an extensive series of tests and reviews to show that the 
product is compliant with existing standards and any special conditions, including lab tests, flight 
tests, and conformity inspections. These analyses, tests, and inspections happen at a component- 
level and an airplane-level, all of which are subject to FAA oversight. If the FAA finds that a 
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proposed new type of aireraft eomplies with safety standards, it issues a type eertificate. Or, in 
the ease of a change to an existing aircraft design, the FAA issues an amended type certificate. 
Facts Concerning the Boeing 737 MAX 

The certification processes described above are extensive, well-established, and have 
consistently produced safe aircraft designs for decades. The Boeing Company has designed and 
built 14 variations of its original model 737 since the FAA issued the original type certificate in 
1967. The FAA followed its standard procedures in determining that the 737 MAX project 
would qualify as an amended type certificate project, and identifying what items would be 
delegated to the Boeing ODA to approve and which would be retained by the FAA for approval. 
Boeing first applied for an amended type certificate for this aircraft in January 2012. As a result 
of regular meetings between the FAA and Boeing teams, the FAA determined in February 2012 
that the project qualified as an amended type certificate project eligible for management by the 
Boeing ODA. The FAA was directly involved in the System Safety Review of the Maneuvering 
Characteristics Augmentation System (MCAS). 

The process from initial application to final certification took five years; the FAA added 
the 737 MAX to the 737 type certificate in March 2017. The process included 297 certification 
flight tests, some of which encompassed tests of the MCAS functions. FAA engineers and flight 
test pilots were involved in the MCAS operational evaluation flight test. The certification 
process was detailed and thorough, but, as is the case with newly certified products, time yields 
more data to be applied for continued analysis and improvement. As we obtain pertinent 
information, identify potential risk, or learn of a system failure, we analyze it, we find ways to 
mitigate the risk, and we require operators to implement the mitigation. And that is what has 
happened in the case of the 737 MAX. 
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737 MAX Accidents and the Decision to Ground the Fleet 


On October 29, 2018, a Boeing 737 MAX operated by Lion Air as flight JT610 erashed 
after taking off from Soekarno-Hatta Airport in Jakarta, Indonesia. Flight JT610 departed from 
Jakarta with an intended destination of Pangkal Pinang, Indonesia. It departed Jakarta at 6:20 
a.m. (loeal time), and erashed into the Java Sea approximately 13 minutes later. One hundred 
and eighty-four passengers and five erewmembers were on board. There were no survivors. An 
Indonesian-led investigation into the cause of this aeeident is ongoing, supported by the National 
Transportation Safety Board (NTSB), FAA, and Boeing. 

On November 7, 2018, based on all available and relevant information, ineluding 
evidenee from the Lion Air aeeident investigation and analysis performed by Boeing, the FAA 
issued an Emergeney Airworthiness Directive. The airworthiness direetive requires operators of 
the 737 MAX to revise their flight manuals to reinforee to flight erews how to reeognize and 
respond to uncommanded stabilizer trim movement and MCAS events. The FAA eontinued to 
evaluate the need for software and/or other design changes to the aireraft ineluding operating 
proeedures and training as additional information was received from the ongoing Lion Air 
aeeident investigation. On January 21, 2019, Boeing submitted a proposed MCAS software 
enhaneement to the FAA for certifieation. To date, the FAA has tested this enhancement to the 
737 MAX flight control system in both the simulator and the aireraft. The testing, whieh was 
eonducted by FAA flight test engineers and flight test pilots, ineluded aerodynamic stall 
situations and recovery proeedures. The FAA’s ongoing review of this software installation and 
training is an ageney priority, as will be the roll-out of any software, training, or other measures 
to operators of the 737 MAX. 
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On March 10, 2019, Ethiopian Airlines flight ET302, also a Boeing 737 MAX, erashed at 
8:44 a.m. (loeal time), six minutes after takeoff. The flight departed from Bole International 
Airport in Addis Ababa, Ethiopia with an intended destination of Nairobi, Kenya. The aeeident 
site is near Bishoftu, Ethiopia. One hundred and forty-nine passengers and eight erewmembers 
were on board. None survived. An Ethiopian-led investigation into the eause of this aeeident is 
ongoing, supported by the NTSB, EAA, and Boeing. 

hollowing the seeond aeeident, the EAA gathered all of the data it had and eontinued to 
review information from the investigation as it beeame available. On Mareh 11, 2019, the EAA 
issued a Continuous Airworthiness Notifieation to the International Community (CANIC) for 
737 MAX operators. The CANIC ineluded a list of all of the aetivities the EAA had eompleted 
in support of the eontinued operational safety of the 737 MAX fleet. These aetivities ineluded 
the airworthiness direetive issued on November 7, 2018, ongoing oversight of Boeing’s flight 
eontrol system enhaneements, and updated training requirements and flight erew manuals. 

After issuing the CANIC, the EAA eontinued to evaluate all available data and aggregate 
safety performanee from operators and pilots of the 737 MAX, none of whieh provided any data 
to support grounding the aireraft. The EAA’s initial review of flight safety data for U.S. 
operators showed no systemie performanee issues and provided no basis to order grounding the 
aireraft. This review ineluded analysis of reeent Aviation Safety Reporting System reports that 
referenee MCAS and/or eontrollability issues with the Boeing 737 MAX. In no ease did the 
reporting party state that the problems experieneed were due to the MCAS system. Also, at that 
time, other eivil aviation authorities had not provided any data to the EAA that warranted aetion. 

On Mareh 13, 2019, however, the Ethiopian Airlines investigation developed new 
information from the wreekage eoneerning the aireraft’s eonfiguration just after takeoff that. 
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taken together with newly refined data from satellite-based tracking of the aircraft’s flight path, 
indicated some similarities between the Ethiopian Airlines and Lion Air accidents that warranted 
further investigation of the possibility of a shared cause that needed to be better understood and 
addressed. Accordingly, the FAA made the decision to ground all 737 MAX airplanes operated 
by U.S. airlines or in U.S. territory pending further investigation, including examination of 
information from the aircraft’s flight data recorders and cockpit voice recorders. 

Next Steps 

The FAA will continue to support the ongoing Lion Air and Ethiopian Airlines accident 
investigations, review the evidence and data obtained, and take immediate and appropriate action 
based on the facts. U.S. and international operators of the 737 MAX are relying on the FAA to 
get it right. I want to assure this Committee and everyone else concerned that the FAA will go 
wherever the facts lead us, in the interest of safety. The 737 MAX will return to service for U.S. 
carriers and in U.S. airspace only when the FAA’s analysis of the facts and technical data 
indicate that it is appropriate. In our quest for continuous safety improvement, the FAA 
welcomes external review of our systems, processes, and recommendations. We will work with 
the newly established Special Committee to Review FAA’s Aircraft Certification Process, 
cooperate fully with the Inspector General’s review, and continue our work with the 
congressionally-mandated Safety Oversight and Certification Advisory Committee and ODA 
Expert Review Panel. 

As recent events have reminded us, aviation does not have borders or boundaries. The 
FAA is focused on continuous safety improvement here at home and internationally through our 
ongoing engagement with other civil aviation authorities and industry stakeholders throughout 
the world. Aviation remains the safest mode of transportation globally, and we promote this 


9 



level of safety by sharing issues, trends, and lessons learned throughout the world. The United 
States is the gold standard in aviation safety. The FAA is resolute in its eommitment to 
maintaining that standard. 

This eoneludes my prepared statement. I will be happy to answer your questions. 
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